zloader | 938f890613dc8526bb828c3de5d5c612b7c13515062fb6ca15f8abc1424f2835

Analysis

Target

d6904948ae99d7bf84e6af9a978c3ae6.dll
Size

666KB
MD5

d6904948ae99d7bf84e6af9a978c3ae6
SHA1

a272ccd04db93604874c8606e4f41ad8bb212540
SHA256

938f890613dc8526bb828c3de5d5c612b7c13515062fb6ca15f8abc1424f2835
SHA512

dbae64e1d607c23e5779fcd3da5e8e1f8348d324b68097758d07ca31a7778d5a22ae701d5999d324063095b61c30cc34a8ca2754dc878d4f87e94cbe72f387b6

Score

10^/10

Family

zloader

Botnet

nut

Campaign

13/04

https://jiaayanu.com/post.php

https://investinszeklerland.eu/post.php

https://iqs-sac.com/post.php

https://jciems.in/post.php

https://jinnahofficersschool.com/post.php

https://kancagh.com/post.php

rc4.plain

rsa_pubkey.plain

Zloader, Terdot, DELoader, ZeusSphinx
Zloader is a malware strain that was initially discovered back in August 2015.
trojan botnet zloader

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 748 wrote to memory of 1864	748	rundll32.exe	rundll32.exe
PID 748 wrote to memory of 1864	748	rundll32.exe	rundll32.exe
PID 748 wrote to memory of 1864	748	rundll32.exe	rundll32.exe
PID 748 wrote to memory of 1864	748	rundll32.exe	rundll32.exe
PID 748 wrote to memory of 1864	748	rundll32.exe	rundll32.exe
PID 748 wrote to memory of 1864	748	rundll32.exe	rundll32.exe
PID 748 wrote to memory of 1864	748	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d6904948ae99d7bf84e6af9a978c3ae6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d6904948ae99d7bf84e6af9a978c3ae6.dll,#1
  2⤵
  PID:1864

memory/1864-60-0x0000000000000000-mapping.dmp

Download
memory/1864-61-0x0000000075041000-0x0000000075043000-memory.dmp

Filesize
8KB

Download
memory/1864-63-0x00000000744C0000-0x0000000074588000-memory.dmp

Filesize
800KB

Download
memory/1864-62-0x00000000744C0000-0x00000000744EB000-memory.dmp

Filesize
172KB

Download
memory/1864-64-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download